IoT firmware loading base address determination method based on pointer reference address

Abstract

The application discloses an IoT firmware loading base address determination method based on pointer reference addresses, comprising the following steps: S1, dividing a complete file into pieces in a logical manner, and taking the starting position of each file piece as a file pointer locate[i]; S2, reading data with a fixed length from the pointer locate[i] of the current file piece by using a multithreading mechanism, and distinguishing data blocks from code blocks by using entropy values; S3, calculating the information entropy of binary data, adding the entropy values to an entropy value table entropy, and calculating the string address in the firmware file and the string address referenced by the pointer; S4, calculating the number of corresponding pointer reference addresses in the string address table, outputting the obtained result in descending order, and bringing the result into reverse analysis of the firmware to determine the base address. According to the number of pointer reference string addresses, the application realizes the identification of the firmware loading base address, and is suitable for the loading base address identification of firmware of various architectures.

Description

Technical Field

[0001] This invention relates to a method for determining the firmware loading base address, and more particularly to a method for determining the IoT firmware loading base address based on pointer reference addresses. Background Technology

[0002] In recent years, IoT devices have permeated all aspects of life, with devices such as cameras, routers, smart sockets, and smart locks bringing great convenience. However, while these smart devices offer convenience, they also pose significant security risks because they carry data and private information generated in people's daily lives. Therefore, device security is receiving increasing attention. These IoT devices all run a special software program, commonly called firmware, which is usually released by manufacturers in the form of firmware update packages or firmware images. Currently, the mainstream processors are 32-bit reduced instruction set processors such as ARM, MIPS, and PowerPC.

[0003] Firmware, as a device "driver" stored internally, enables the operating system to perform specific machine actions according to standard device drivers. In hardware devices, firmware is the soul, responsible for managing hardware peripherals and implementing application functions. Firmware is categorized into two types based on whether it contains a complete file system: those with and without. Analyzing firmware with a file system typically requires unpacking the firmware, extracting the complete file system, and then analyzing the extracted files. For firmware without a file system, since it lacks a file system, reverse engineering software is usually used for analysis.

[0004] When performing reverse engineering by disassembling firmware, it is necessary to know two key pieces of information: the processor type of the firmware's runtime environment and the load base address. The load base address mainly affects references to absolute addresses, such as jump function tables and string tables, and a correct base address can improve analysis coverage. On the other hand, knowing the correct base address allows for a comprehensive understanding of the firmware's distribution in memory. When patching firmware, if the inserted instructions reference absolute memory, the load base address must be known.

[0005] Existing automated firmware loading base address location methods do not fully consider the differences in processor types, do not incorporate the firmware characteristics of devices with different architectures into the research, and are slow and have low accuracy. Summary of the Invention

[0006] Purpose of the invention: The purpose of this invention is to provide a method for determining the base address of IoT firmware loading based on pointer reference addresses, which has a fast positioning speed and high accuracy.

[0007] Technical solution: The present invention provides a method for determining the base address of IoT firmware loading based on pointer reference addresses, comprising the following steps:

[0008] S1 divides the complete file into equal parts logically while ensuring the integrity of the file. The starting position of each file segment is the file pointer locate[i].

[0009] S2 reads fixed-length data from the pointer locate[i] of the current file segment using a multi-threaded mechanism, distinguishes data blocks from code blocks using entropy characteristics, and converts binary data into hexadecimal characters;

[0010] S3, calculate the information entropy of the binary data, obtain the entropy value h(X), add it to the entropy table entropy, and calculate the string address and the string address referenced by the pointer in the firmware file;

[0011] S4. Calculate the number of times the corresponding pointer references the address in the string address table, output the result in descending order, and use it in the reverse analysis of the firmware to determine the base address.

[0012] Furthermore, in step S1, the file is read in as a binary data stream, the firmware file size FileSize is calculated, and the file is logically divided into N segments of length size.

[0013] Furthermore, in step S2, the file length is divided into pieces[1], piece[2], piece[3], ..., piece[N], and the length of the file read each time is limited by a sliding window mechanism.

[0014] Furthermore, when reading data from the i-th file fragment piece[i], the specific implementation steps are as follows:

[0015] S21, set the file pointer to locate[i] = i * size;

[0016] S22, read the binary data stream bytes[i] of file fragment piece[i] from the position of locate[i];

[0017] S23 uses multi-threading to read data and converts binary bytes[i] into hexadecimal data hex[i].

[0018] S24. Based on the entropy characteristics, distinguish the regions of data blocks and code blocks in the file: the entropy of data blocks is considered to be between 0 and 0.5, and the entropy of code blocks is considered to be between 0.6 and 0.8.

[0019] S25, based on the storage pattern of hexadecimal data hex[i] strings, output the string address set M in the firmware file;

[0020] S26, the firmware file places the string address as an immediate value in the register, and the pointer reference effect is achieved by calling the register through the instruction, and the set of string addresses referenced by the pointer is output as R.

[0021] Furthermore, in step S3, the entropy table of the obtained data is calculated to distinguish between data blocks and code blocks in the file, and the fine-grained implementation steps for calculating the string addresses and pointer references in the file data blocks are as follows:

[0022] S31, in the entropy analysis of the firmware, the entropy value calculation formula h(x) is used to obtain the entropy value table entropy, and the data blocks in the file are determined based on the entropy value range of 0 to 0.5; the entropy value calculation formula is as follows:

[0023]

[0024] Where X is a random variable in [0, 31], and P(X = i) represents the true distribution;

[0025] S32, Calculate the string addresses and pointer references to the string addresses in the firmware file obtained in step S2;

[0026] S33, calculate the number of references in the string address set R corresponding to the pointers in the string address set M, and output the reference count results output by data matching in descending order.

[0027] Furthermore, in step S4, the implementation steps for determining the base address are as follows:

[0028] S41, extract the first ten data points from the calculation results in step S3, and use the analysis tool to input the obtained base address to perform reverse analysis on the firmware;

[0029] S42. If a large number of functions in the firmware are identified during reverse analysis, and the pointers jump correctly and the strings form cross-references, then the analysis coverage is broad, and proceed to step S43; otherwise, proceed to step S44.

[0030] S43, output the correct base address, end;

[0031] S44, output base address is incorrect base address, end.

[0032] Compared with the prior art, the significant advantages of this invention are as follows:

[0033] 1. Logically divide the firmware file into file segments of the same size, and use the entropy value to distinguish between data blocks and code blocks, thus narrowing the traversal range. Based on the correspondence mechanism of matching pointer reference addresses with string addresses, multi-threaded program calculation is adopted to reduce the calculation time and obtain the correct load base address.

[0034] 2. Taking into full account the differences in processor types and studying the commonalities between device firmware, the system identifies the load base address for mainstream 32-bit processor architectures such as ARM, PowerPC, and MIPS. This method has a certain degree of universality and high accuracy. Attached Figure Description

[0035] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0036] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0037] As shown in Figure 1, the IoT firmware loading base address determination method of the present invention includes four stages: file analysis stage, file reading stage, data calculation stage, and firmware base address determination stage. The functions completed in each stage are as follows:

[0038] File analysis phase: Read firmware files of ARM and MIPS architectures using binary data stream, calculate the firmware size as FileSize, and divide the complete file into N file segments in a logical manner, each segment being size, while ensuring the integrity of the file.

[0039] File reading stage: The file is divided into pieces[1], piece[2], piece[3]...piece[N]. When reading the data in the i-th file piece[i], the starting position of each file piece is the file pointer locate[i] = i*size; a multi-threaded mechanism is used to read data of fixed length, and the entropy value is used to distinguish data blocks from code blocks, and binary data is converted into hexadecimal data;

[0040] Calculation phase: This phase calculates the entropy table of the data obtained in the file reading phase, distinguishes between data blocks and code blocks in the file, and calculates the set of string addresses M and the set of string addresses R referenced by pointers in the file data blocks;

[0041] Firmware base address determination stage: First, calculate the number of times the string address set M appears in the pointer reference address set R. Output the string addresses and their corresponding number of occurrences in descending order of the number of occurrences. Finally, use the string address with the highest number of occurrences as the loading base address and bring it into the reverse analysis of the firmware for base address determination.

[0042] The IoT firmware loading base address determination method of the present invention includes the following steps:

[0043] Step 1, Document Analysis Phase

[0044] Firmware files for ARM and MIPS architectures are read in as binary data streams, the file size FileSize is calculated, and the file is logically divided into N segments of length size.

[0045] Step 2, File Reading Stage

[0046] The file length is divided into pieces[1], piece[2], piece[3], ..., piece[N]. A sliding window is used to correspond to a continuous memory sequence, and the number of basic memory units that the sliding window can accommodate is a fixed value. Since the processor type is a 32-bit instruction set architecture, the sliding window size wndsize is set to a multiple of 4 bytes to limit the length of each read during the reading of file segments.

[0047] The detailed steps for reading the data in the i-th file fragment piece[i] are as follows:

[0048] Step S21, set the file read position to

[0049] locate[i] = i * size (1)

[0050] Where i = 1, ..., N.

[0051] Step S22: Starting from the position of locate[i], read the contents of the file fragment piece[i] in binary mode and generate a binary data stream bytes[i].

[0052] Step S23: Use the Executors plugin to call the newFixedThreadPool() method to create a fixed-size thread pool, which can control the maximum number of concurrent threads. Threads exceeding the limit will wait in the queue. In the program, multiple threads are used to read file fragment piece[i] simultaneously, and i is set to i+1 to read file fragments one by one until i=N; and the binary data bytes[i] is converted into hexadecimal data hex[i].

[0053] Step S24: During the iterative search for strings in the firmware, due to the large amount of content in the firmware itself, searching the entire firmware file would be extremely inefficient. The firmware mainly consists of two regions: data blocks and code blocks. Text content such as strings is located in the data region. By calculating and analyzing the entropy values ​​of the corresponding data blocks and code blocks in the firmware file, the data block entropy is considered to be between 0 and 0.5, and the code block entropy is considered to be between 0.6 and 0.8, thus distinguishing the data block and code block regions in the file.

[0054] Step S25: Based on the storage pattern of hex[i] strings, search for strings in the data block. The starting address of the string is a multiple of 4, and the bytes filled at the beginning and end of the string in the storage location are all 0x00. Based on this feature, output the string address set M in the firmware file.

[0055] In step S26, the string address is placed in the register as an immediate value in the firmware file. The register is called by the instruction to achieve the effect of pointer reference. Based on the machine code 0x9FE5 of the ldr instruction in the ARM architecture and the machine code 0xF000 of the lui instruction in the MIPS architecture, the contents of the register called by it are found, that is, the string address referenced. The set of string addresses referenced by the pointer is output as R.

[0056] Step 3, Data Calculation Stage

[0057] In step S31, during the entropy analysis of the firmware, the entropy of the data bytes[i] in step S23 is calculated using the entropy value calculation formula, and the entropy value h(X) is obtained and added to the entropy value table entropy. The data blocks in the firmware file are determined based on the entropy value being in the range of 0 to 0.5.

[0058] The formula for calculating entropy is as follows:

[0059]

[0060] Since the processor instruction set is 32-bit and file segments are read as binary data streams, X is a random variable in [0, 31]; P(X = i) represents the true distribution.

[0061] Step S32: Calculate the string address set M in the firmware file obtained in step S25 and the string address set R referenced by the pointer in step S26.

[0062] Step S33: Calculate the number of references to the string addresses referenced by the pointers in the string address set M, and output the string addresses and their corresponding reference counts in descending order of reference count. The higher the reference count, the more likely the string address is to be the load base address.

[0063] Step 4, Firmware Base Address Determination Stage

[0064] Step S41: Extract the first ten string addresses obtained in step S33. Since reverse engineering is used to analyze whether there are security vulnerabilities in firmware and to perform digital forensics, obtaining the correct load base address is a key step in reverse engineering. Use the reverse analysis tool IDA Pro for manual verification, and input the first ten string addresses obtained in sequence as the load base address to perform reverse analysis on the firmware.

[0065] Step S42: If a large number of functions in the firmware are identified during reverse analysis, and the pointers jump correctly and the strings form cross-references, then the analysis coverage is broad, proceed to step S43; otherwise, proceed to step S44.

[0066] Step S43: Output the correct base address and end.

[0067] Step S44: Output the base address as an incorrect base address, then end.

[0068] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for determining the loading base address of IoT firmware based on pointer reference addresses, characterized in that, The steps include the following: S1, divide the complete file in a logical manner and ensure the integrity of the file, and the starting position of each file segment is file pointer locate[i]; S2, read the fixed-length data from the pointer locate[i] of the current file segment using a multi-thread mechanism, distinguish the data block and the code block using the entropy value, and convert the binary data into hexadecimal characters; S3, calculate the information entropy of the binary data, and obtain the entropy value and add the entropy value table entropy, and calculate the string address in the firmware file and the string address referenced by the pointer S4, calculate the number of pointer reference addresses in the string address table, output the obtained result in descending order, and input it into the reverse analysis of the firmware to determine the base address; In step S3, the entropy of the obtained data is calculated to distinguish the data block and the code block in the file, and the detailed implementation steps of the string address and the string address referenced by the pointer in the file data block are as follows: S31, in the entropy analysis of the firmware, an entropy value calculation formula is used , an entropy value table entropy is obtained, and data blocks in the file are determined according to the entropy value in the range of 0-0.5; the entropy value calculation formula is as follows: ， where X is a random variable in [0, 31], denotes the true distribution; S32, count the string addresses and the string addresses referenced by the pointer in the firmware file obtained in step S2; S33, calculate the reference times of the string address set M corresponding to the string address set R referenced by the pointer, and output the reference times result matched by the data in descending order.

2. The method of claim 1, wherein the method is based on a pointer reference address of an IoT firmware loading base address. In step S1, the file is read into a binary data stream, the size of the firmware file FileSize is calculated, and the file is logically divided into N segments with a length of size. 3.The IoT firmware loading base address determination method based on a pointer reference address according to claim 1, characterized in that, In step S2, the file length is divided into piece[1], piece[2], piece[3], …, piece[N], and the sliding window mechanism is used to limit the size of the file length read each time.

4. The method of claim 3, wherein the method further comprises: When reading the data in the ith file segment piece[i], the specific implementation steps are as follows: S21, set the file pointer to locate[i]=i*size; S22, read the binary data stream bytes[i] of the file segment piece[i] from the locate[i] position; S23, read the data using a multi-thread and convert the binary bytes[i] into hexadecimal data hex[i]; S24, according to the entropy value characteristics, distinguish the data block and the code block region in the file: the entropy of the data block is considered to be between 0 and 0.5, and the entropy of the code block is considered to be between 0.6 and 0.8; S25, according to the regularity of the hexadecimal data hex[i] string storage, output the string address set M in the firmware file; S26, the string address in the firmware file is placed in the register as an immediate number, and the pointer reference effect is achieved through the instruction call register, and the string address set R referenced by the pointer is output.

5. The method of claim 1, wherein the method further comprises: In step S4, the implementation steps of the base address determination are as follows: S41, take the first ten data in the calculation result in step S3, input the obtained base address into the firmware using the analysis tool for reverse analysis; S42, if a large number of functions in the firmware are identified in the reverse analysis, and the pointer correctly jumps and the strings form cross-references, the analysis covers a wide range, and go to step S43; Otherwise, go to step S44; S43, output the base address as the correct base address, and end; S44, output base address is error base address, end.

Images